Threats Tagged 'cve-2026-41257'

Multiple security vulnerabilities have been identified and fixed in the jq tool by the SUSE Product Security Team. These include heap buffer overflows, integer overflows, unbounded recursion leading to resource exhaustion, missing runtime type checks causing crashes, out-of-bounds reads, denial of service via resource exhaustion, memory corruption, and validation bypass. The vulnerabilities affect jq version 1.7.1-160000.3.1.aarch64. No known exploits in the wild have been reported.

This update includes the following RPMs: jq: * jq-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-devel-1.8.2-0.1.hum1 (aarch64, x86_64) * jq-1.8.2-0.1.hum1.src (src)

CVE-2026-41257 is a medium severity integer overflow vulnerability in jq, a command-line JSON processor. Versions 1.8.1 and earlier have a flaw in the jq bytecode VM's data stack allocation size tracking, which uses a signed integer. When the stack grows beyond approximately 1 GiB due to deeply nested generator forks, the doubling arithmetic overflows, causing the wrapped value to be passed to realloc and used in a memmove with attacker-controlled offsets. This can lead to memory corruption. No official patch or remediation guidance is currently available, and no known exploits are reported in the wild.